The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides comprehensive technical details, SQL queries, and Python code to read the user's entire unencrypted iMessage history from ~/Library/Messages/chat.db. It also details how to access the system's TCC database (~/Library/Application Support/com.apple.TCC/TCC.db), which contains sensitive permission mappings for all applications.
[REMOTE_CODE_EXECUTION]: The documentation encourages the installation of a Python library directly from a GitHub repository using an unverifiable placeholder account: pip install git+https://github.com/my-other-github-account/imessage_tools.git. Installing code from unknown or non-standard sources poses a significant security risk.
[COMMAND_EXECUTION]: The skill relies on osascript and shell commands to automate the Messages app and modify system settings. This facilitates the execution of arbitrary AppleScript, which can be used to send unauthorized messages or disrupt system security states via commands like tccutil reset.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external message data that could contain malicious instructions.
Ingestion points: Reads message content and metadata from chat.db as shown in SKILL.md and references/python-reading.md.
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands in the messages it reads.
Capability inventory: Includes sending messages via osascript and performing file system operations on the database and attachments.
Sanitization: No sanitization or validation of message content is provided in the example scripts or recommended tools.

imessage-mac